Arista EOS (EVPN VXLAN MAC/IP binding): Malformed packets create incorrect MAC-to-IP bindings in an EVPN VXLAN fabric

CVSS 5.9CVE-2020-26569Firmware, BMC & network fabriccurated

Impact

Malformed packets create incorrect MAC-to-IP bindings in an EVPN VXLAN fabric, and packets get forwarded across VLAN boundaries as a result. An attacker who can source crafted frames from inside one tenant's overlay can poison the fabric's bindings and cause traffic to cross into the wrong VLAN. The advisory notes traffic is discarded on the receiving VLAN, which limits it to a leak-and-drop rather than a clean interception — but it is still a control-plane-driven breach of the segmentation model.

Who can reach it

A host inside an EVPN VXLAN tenant network able to emit specific malformed packets.

What to do

EOS upgrade plus reload across the VTEP layer. No live workaround. If you run EVPN multi-tenancy, also audit the MAC/IP binding table for entries that do not correspond to a real workload.

References

https://nvd.nist.gov/vuln/detail/CVE-2020-26569

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.